image:
  repository: freepeak/db-mcp-server
  tag: ""
  pullPolicy: IfNotPresent

port: 9092

# Name of a Secret holding the whole multi-database config as one JSON blob,
# mounted as a file at /app/config.json (the image's own CONFIG_PATH
# default) -- overriding it by file, not the DB_CONFIG env var, because the
# image ships a baked-in CONFIG_PATH pointing at its own sample config,
# which a same-named env var does NOT take priority over (file always wins;
# confirmed empirically -- DB_CONFIG alone silently loaded the sample DBs
# instead of ours). Keeps connection strings/passwords for every database
# out of a plain ConfigMap.
existingSecret: ""
secretConfigKey: "config.json"

env:
  TRANSPORT_MODE: "sse"
  SERVER_PORT: "9092"
  LOG_LEVEL: "info"
  CONFIG_PATH: "/app/config.json"

# Persistent audit log (DB_MCP_AUDIT_LOG) -- one JSONL record per executed
# statement, including rejected writes against read-only databases. Kept on
# a small PVC so it survives pod restarts; this is the primary compensating
# control for a server with broad read/write reach across many databases.
auditLog:
  enabled: true
  dir: /var/log/db-mcp
  path: /var/log/db-mcp/audit.jsonl
  storageClass: local-path
  size: 1Gi

resources:
  requests:
    cpu: "50m"
    memory: "128Mi"
  limits:
    cpu: "500m"
    memory: "512Mi"

nodeSelector: {}

tolerations: []

ingresses: {}
  # https:
  #   host: pg.mcp.example.com
  #   annotations: {}
  #   tls:
  #     - hosts:
  #         - pg.mcp.example.com
  # lan:
  #   host: pg.mcp.example.lan
  #   annotations: {}